Add decrypted IPA sideload flow for JB VMs

[yeraldinm]

Summary

• add make ipa_install target and new scripts/ipa_install.sh helper for decrypted IPA sideloading on running JB VMs
• re-sign Mach-O binaries in IPA, then install via ideviceinstaller when available with fallback to direct rootless/container copy + uicache
• harden ramdisk_build.py to skip generating krnl.ramdisk.img4 when dynamic kernel patching fails or matches zero sites
• add explicit preflight error in Makefile if scripts/ipa_install.sh is missing

Why

Issue #29 asks for installing decrypted IPAs without App Store. This adds a practical sideload workflow and safety checks around the new path.

Validation

• python3 -m py_compile scripts/ramdisk_build.py
• zsh -n scripts/ipa_install.sh
• make -n ipa_install IPA=/tmp/demo.ipa VM_DIR=/tmp/vm

Notes

• ipa_install tries MobileInstallation first and falls back automatically to rootless/container copy path.

[fedoradeath-tech]

To do this, do I need to use the installation option with the jb patch? Does it work on the current branch? cfw_install_jb and then use ipa_install?

[yeraldinm]

To do this, do I need to use the installation option with the jb patch? Does it work on the current branch? cfw_install_jb and then use ipa_install?

Yes, recommended path is JB: run fw_patch_jb + cfw_install_jb, boot the VM, then run make ipa_install VM_DIR=... IPA=....

You do need SSH access to the device first (usually via iproxy to localhost:22222, and dropbear/SSH running in the guest). ipa_install uses SSH for file copy and uicache

[fedoradeath-tech]

But the JB patch doesn't work correctly in the current branch. After ramdisk_send, there's no success message indicating the server has started.